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Road Map 


• Key Evidence 

• Formal Education and Training 

• Work as an Intelligence Analyst 

• Knowledge of WikiLeaks 


Road Map 


• Gharani Video (BE22PAX) 

• CIDNE-I & CIDNE-A SIGACTS 

• ACIC Report 

• Apache Video 

• Password Cracking 

• JTF-GTMO Assessments 

• OGA Documents 

• Department of State Cables 

• Farah Investigation File 

• USF-IGAL 


Road Map 


• Causing Intelligence to be Published 

• Aiding the Enemy 


305 th Ml Battalion 



Information Security 
AR 380-5 



Classification Designations 


AR 380-5, page 10, para 2-10 


Confidential - Cause Damage 

Secret - Cause Serious Damage 

Top Secret - Cause Exceptionally Grave 
Damage 


To National Security. 


Classification Process 


page 9, para 2-7 


In making a decision to originally classify an item of 
information, an original classification authority will: 



a. Determine that the information has not already 
been classified 

b. Determine that the information is eligible for 
classification 


c. Determine that classification of the information is 
a realistic course of action and that information can 
be protected from unauthorized disclosure when 
classified. 


d. Decide that unauthorized disclosure could 
reasonably be expected to cause damage to national 
security. 
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2 





page 9, para 2-8 


3 


> Military Plans, Weapons Systems, or Operations 

> Foreign Government Information 

> Intelligence Activities, sources or methods 

> Foreign Relations Or Activities Of The US 

> Scientific, Technological, Or Economic Matters 
Relating To National Security 

> US Government Programs For Safeguarding 
Nuclear Materials Or Facilities 

> Vulnerabilities or capabilities of systems, 
installations, projects or plans relating to national 
security 10 



Prohibitions and Limitations 


page 9-11, para 2-8, 2-15 


V 


^Conceal violations of law, inefficiency, or 
administrative error 

> Prevent embarrassment to a Person, Agency 
or Organization 

> Restrain competition 


US classification can only be applied to 
information that is owned by, produced by or for, 
or is under the control of the US government. 
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Declassification Programs 


page 14, para 3-1 


Department of the Army files and records will not be 
declassified without prior review to determine if 
continued classification is warranted and authorized. 

(1) Original classification authority action 

(2) Automatic {Per Executive order) 

(3) Mandatory 


(4) Systematic 


Individual Responsibility 


page 3, para 1-9 


-All personnel have an official responsibility to 
safeguard classified information. 

• All personnel will report any violations or 
anything that could lead to the unauthorized 
disclosure of classified and sensitive 
information. 


Storage Standards 


page 78, para 7-3 


Classified information must be secured under 
adequate conditions to limit access by unauthorized 
personnel. 

• General Services Administration (GSA) 

establishes and publishes minimum standards, 
specifications, and supply schedules for: 

- Containers 

- Vault Doors 

- Alarm Systems 

- Associated security devices suitable for 
storage and protection of classified material. 



Control Measures 


page 67, para 6-9, 6-10 


• DA personnel are responsible for ensuring 
that unauthorized persons do not gain 
access to classified information. 


• Classified information will be protected at 
all times either by storage, having it under 
personal observation and physical control 
of an authorized individual. 
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Control Measures 


page 33, para 4-34 


Classified labels will be 
placed on all classified 
Automated Data Processing 
media 


Others that may be used/seen: 

SF 711 - Data Descriptor Label 

(yellow & black) 
SF 712 CLASSIFIED SCI Label 
(yellow & white) 




SF 708 


SF 707 


SF706 
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12 JUL 07 
CZ ENGAGEMENT 
ZONE 30 GC 


> imation 



CD-RW 1 1 

F ?nnMB BO nun 


This medium is classified 

SECRET 

U.S. Govor nmenl Property 
Protect It from unauthorized 
disclosure In compliance wllh 
applicable executive orders. 

statutes, and regulations. ' 


The enemy will attempt to discover how and 
when we are conducting operations, knowing 
this, we must protect our activities from 
detection. 

We do this by: 

•Identifying - Critical Information 
•Analyzing - Threat 


mm 


Critical Information 


> Photos 

> Installation maps with highlights of 
designated points of interest (sleep/work, 
CDR, dining facility, etc) 

> Security Operating Procedures (SOPs) 

> Tactics, Techniques and Procedures (TTPs) 

> Unit Capabilities and Intent 

> Unit morale 

> Personal/Family Information 


Sensitive Information 


> DON'T DISCUSS OPERATIONAL ACTIVITIES 
ON THE WEB or E-mail 

> Ensure information posted has no 
significant value to the adversary 

> Consider the audience when you're 
posting to a blog, personal web page 
or Email 

> Always assume the adversary is 
reading your material 

> Work with your OPSEC Officer - follow 
policies and procedures! 

Remember it is called the World Wide Web for a 
reason 



Al Qaeda 

AKA: Usama Bin Ladin Organization 



• Extreme Sunni (Wahabi) 
Islam 

• NO religious tolerance 

• Loose structure, little 
secrecy about leadership 

• Network with many other 
like-minded groups 

• State support (?) 


PE 51, page 5 


Tanzim Qaeda al-Jihad fi Bilad al-Rafidayn (QJBR) 
AKA: Al Qaeda in Iraq (AQI), Tawhid and Jihad, AQIZ 




"Monotheism and Holy 
War" 

- The al Qaeda Group for 
Jihad in Iraq 


• Ties to al-Qaeda 



Abu Ayyub al-Masri_an Egyptian 
operative is believed to be the new leader 
of Al Qaeda in Iraq. 


Kidnappings and 
executions 

Has also attacked Iraqi 
Police & Security 
Forces 


219 


PE 51, page 8 




Baghdad , 
April 2003 1 


Islamic extremists are exploiting the 
Iraqi conflict to recruit new anti US 
Jihadists. 221 


PE 51, page 10 


Recruiting 



"No thanks, just browsing." 

Over the last ten years, the number of terrorist sites has 
jumped from less than 100 to as many as 4,000. Many 
insurgency groups have many sites and message boards to 
help their network. 


PE 51, page 12 
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i Information Assurance Awareness 


Critical Infrastructure Protection 



Critical infrastructure 
includes: 

• Information technology and 
telecommunications 

• Energy 

• Banking and finance 

• Transportation and border 
security 

• Water 

• Emergency services 


To continue, select the forward arrow. 


e past, computers were standalone systems that were relatively easy to protect. What was once a collection of separate systems is now best understood as a 
I single, globally connected network, including infrastructures neither owned nor controlled by DoD. Because of the interconnected nature of our information systems, a I — ! | 
I risk to one is a risk to all. If information and information systems are compromised, it can impact our missions, our national security, and ultimately, lives. In addition. 
| because information systems are a vital part of the critical infrastructure of our country, our way of life is potentially at risk if information systems aren't adequately 


r L)uD 


, Information Assurance Awareness 


THREAT 


Environmental Threat |- 


- \ Human Threat"") 


Natural 
Events 


Lightning 


Fires 

j 

Hurricanes 


Tornadoes 

j 

Floods 


System 
Environment 


Poor wiring 

Insufficient 
cooling 


Internal 


Disgruntled 


employees 

<* 

Spies or 


terrorists 


Unintentional 


damages 

1 


To continue, select the forward arrow. 


I event A system s environment, including poor nuilding wiring or insufficient cooling forthe systems, can also cause harm to information systems Human threats can 
I be internal or external. Internal threats can oe careless, malicious or disgruntled users, users in the employ of terrorist groups orforeign countries, or can be seff- 
1 inflicted unintentional damage, sucti as accidents or bad habits External threats can be hackers, organized crime, terrorist groups, foreign countries, or protesters 
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UNCLASSIFIE 
D 




Operations Security (OPSEC) 




PV2 Manning, Bradley 
D Company, 305 th Military Intelligence Battalion 
Friday, 13 Jun 08 



UNCLASSIFIE 
D 



PE 25, page 1 



PE 25 , page 2 



PE 25 , page 3 



PE 25 , page 4 



PE 25 , page 5 




PE 25 , page 7 



PE 25 , page 8 



PE 25 , page 9 


UNCLASSIFIE 
D 


Common OPSEC Leaks 


Written Sources 

- Newspapers 

- Magazines 
Television 

- News Programs 

- Documentaries 
Internet 

- Discussion Boards 

- Chat Rooms 

- Social Networking 

- Videos 


CLASSIFI 


PE 25 , page 10 


UNCLASSIFIE 


Conclusion 


Avoid Disclosure of Information 

- Public Conversations 

- Journalists 

- Posting Information 

. Newsletters 
. Fliers 
. Internet 
Use Common Sense 

- Many Enemies 

- Free and Open Society 



you can currently contact our investigations editor directly in Iceland +354 862 
3481 ; 24 hour service; ask for "Julian Assange" . 
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WikiLeaks O 


¥ Follow 


Have encrypted videos of US bomb strikes 
on civilians littp://bit.ly/wlafghan2 we need 
super computer time http://ljsf.org/ 

Reply t£l Retweet "if Favorite ••• More 

147 37 3*a.. a 6 a wis© 
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Items of Historical Significance for Two Wars: 

Iraq and Afghanistan Significant Activities (SIGACTs) between 0000 on 01 JAN 2004 and 
2359 on 31 DEC 2009 (Iraq local time, and Afghanistan local time) 

CSV extracts are from the Department of Defense (DoD) Combined Information and Data 
Exchange (CIDNE) Database. 

It's already been sanitized of any source identifying information. 

You might need to sit on this information, perhaps 90-180 days, to figure out how best to 
release such a large amount of data, and to protect source. 

This is possibly one of the more significant documents of our time, removing the fog of war, 
and revealing the true nature of 21 st century asymmetric warfare. 

Have a good day. 


PE42 


PE40 


Good question. 


There's a few answers I have to various other questions as well: 

1. # ' Mil fe* >M%ti&&: $b&&lk9 ^ id&ti (Had a 
written description.) 

2. I "saw" an RPG and many, many more weapons the first time I saw the 
video. I was numb. I explored it further, and found out what actually 
happened later. I wanted the video to challenge that cognitive bias that 
every young Iraqi male is an insurgent. 

3. I instructed there to be an Orwell quote, description of the 
journalists, and some general context. \ * .-. . 'liM^^^SB&SSmKK^B 
! — hi r;-p: -:'&tp. It literally means "unintentional murder." 

4. Public Relations is an area WikiLeaks needed some desperate help in, 
since the only people who had heard of them before were people in the 
hacker, journalist, and intelligence communities, 

5. Video personally pissed off Assange, and he wanted to "get out of 
exhile. " 


PE 41, page 1 
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PE 186, page 285 



A NOTE ON SOURCES AND METHODS 


Most of this book is based on events I personally observed between January 2007, when 
I first met the 2-16, and June 2008, the month of the Ranger Ball. I spent a total of eight 
months with the 2-1 6 in Iraq and made additional reporting trips to Fort Riley, in Kan- 
sas; Brooke Army Medical Center, in San Antonio, Texas; the National Naval Medical 
Center, in Bethesda, Maryland; and Walter Reed Army Medical Center, in Washing- 
ton, D.C. 

The book also contains some scenes for which I wasn't present. In those instances, 
the details, descriptions, and dialogue used in the book were verified through internal 
army reports, photographs, videos, after-the-fact observation, and interviews with as 
many participants as conditions would permit. All of the people described and quoted 
in the book knew that I was a journalist and that everything I was seeing and hearing was 
on the record. 

It is to the army's credit, I believe, that during the length of" my reporting, there 
were only two times that 1 was asked to treat something as off the record. Both requests 
involved classified technological applications in use by the soldiers, the revealing of 
which could conceivably put subsequent soldiers using the applications at increased 
risk, and I agreed to do so. 

And it is to the 2-16 soldiers' credit diat they tolerated a journalist being among 
them, and in almost all cases welcomed me with their trust. From the beginning, I 
explained to them that my intent was to document their corner of the war, without 
agenda. This book, then, is that corner, unshaded. I feel privileged to have been its wit- 
ness, and to write the story of what happened. 


wget -h el p 

gnu wget 1.11.4, a non-interactive network retriever. 
Usage : wget [OPTION] . . . [URL] . . . 

Mandatory arguments to long options are mandatory for short options too. 


startup: 

-V, --version 

-h, —help 

-b, --background 

-e, --execute^coMMAND 

Logging and input file: 


display the version of wget and exit, 
print this help, 
go to background after startup, 
execute a .wgetrc' -style command. 


-o , --output-f i 1 e~FlLE 

-a, --append-output=F!LE 

-d, --debug 

-q, --quiet 

-v, --verbose 

-nv, --no-verbose 

-i , --input~file=FiLE 

-F f --force- html 

-b, --base-URL 


log messages to file. 

append messages to FILE. 

print lots of debugging information, 

quiet (no output). 

be verbose (this is the default). 

turn off verboseness, without being quiet. 

download URLs found in FILE. 

treat input file as HTML. 

prepends URL to relative links in -F -i file, 


PE 189, page 1 
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WikiLeaks O 

wtMleatcs 


>0 Follow 


We would like a list of as many .mil email 
addresses as possible. Please contact 
e<Htor@wiMleaks.org or submit 

Reply Retweet ♦ Favorite •••More 

2:37 PW- 7 May 10 
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Group/ cn-Reci pienta/cn=j ohn JMIHIB . iraq . cent com. mi 1 
/o=2BCT10MTN/ou=First Admin istrati ve 
Group/ cn=Recipients/cn-lena 111 . iraq . centcorn . mi 1 
/ o=2BCTl OMTN/ ou—First Administ rative 

Group/cn=Recipients/cn==michael JR1HM . 4bct2id .army . ml 1 
/o=2BCTlOMTN/ou=First Adminis trativ e 

Group/cn-Recipients/cn-shawri. J^SSSM' iraq. centcorn. mil 
/o=2BCT10MTN/ou=First Adminis trativ e 

Group/cn=Recipients/cn=tasha .MgIBIM.iraq.centcom.mil 

/ o=2 BCT 1 OMTN / ou= Fi r s t Adminis trative 

Group/cn=Recipients/cn=tracey.|MM. iraq. centcorn, nu 1 
/o=2BCT10MTN/ou-First Administrative 

Group/cn==Recipients/cn=zachary Bfgfgj .iraq . centcorn. mi 1 
/o-2BCT10MTN/ou=First Administrative 

Group/cn=Recipients/cn=jessica .1SB1B1 . iraq . centcorn . mil 
/o=2BCT10MTN/ou=First Administrative 

Group/ cn=Recipients/cn=thomas ffi— . iraq . centcom.mil 
/ o-2 BCT 1 OMTN /ou-First Admin i s tr ative 

Group/cn=Recipients/cn=muhammad Bjfgfj . 4bct2id . army .mil 
/o-2BCT10MTN/ou-First Administrative 


(b)(7)(c) 
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MH John MSG MNF-I EOD 

W, Christopher SPC 1AAB S2 ANALYST 
■■^Rayn R MA J BUCCA JIDC OIC 

^< Guy D 1SG 155th ICTC 
|, Ryan E SSG 306th MP BN 

II, John W SPC 328th MP CO Sallyport 
I, Lena C IT1 SOFTLEIZ NCOIC 
I, Michael W SPC 4/2 HHC S6 
I Shawn H SPC MNOI 86 CSH Light Wheeled Mech 
I Tasha R SSG Mission CDR 
| Tracy H SGT PLL Clerk 
/ Zachary J PFC C 114th IN SDC Guard 
r Jessica L SGT 259th CSSB HR SPEC 
| Thomas J. AlC USAF 532 ESFS Security Force USA 
/ Muhammad SGT 702d BSB SPO Mortuary Affairs 

Ryan V, CPO,NPDB-5 
r Olasunkanmi SPC Gl USD-C, B CO G-l Strength Clerk 
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Full Path \1 CustomerMJnallocated Clusters 

File Offset 66637168640 

TASK: Acquire and exfiltrate Global Address List from United States 
Forces - Iraq (USF-I) Microsoft Outlook / Sharepoint Exchange 
server 

PURPOSE: To e-mail classified messages from USF-I's CIDNE event log 
from 2004 to 2009, 

METHOD : Acquire document 

ENDS TATE: 

TARGET: United States Forces - Iraq (USF-I) Outlook / Sharepoint Exchange Server 
OBJECTIVE : 
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